MALPEDIA_Win_Torisma_Auto

rule MALPEDIA_Win_Torisma_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "429c4685-02ab-53bb-bf5a-5d589554aaee"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.torisma"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.torisma_auto.yar#L1-L135"
		license_url = "N/A"
		logic_hash = "e05205fd2ec61ac7ebc1e65ee815290cba6c9a83ebb3a4a6c0d647bde599cf40"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 7402 eb05 e9???????? b833280000 }
		$sequence_1 = { e8???????? 3d83490000 7507 b883490000 }
		$sequence_2 = { e8???????? 3d514b0000 7504 33c0 }
		$sequence_3 = { 740d 8b4dd8 e8???????? 8945c0 }
		$sequence_4 = { 8d4310 8d89f4cd0110 5a 668b31 668930 }
		$sequence_5 = { 334dfc 894dfc 8b4d08 8b5164 }
		$sequence_6 = { 4881ec98000000 48c7442460feffffff b914000000 e8???????? 4889442438 48837c243800 }
		$sequence_7 = { c644245137 c644245282 c644245367 c644245432 }
		$sequence_8 = { 48c744244800000000 488b4c2438 e8???????? 488b442438 4889842480000000 }
		$sequence_9 = { 39442424 7202 eb2a 48837c245800 7413 }
		$sequence_10 = { 0bd1 8bca 898c24ac000000 488b542478 8b5210 488b7c2470 8b1497 }
		$sequence_11 = { 6a03 8b55f8 8b4204 50 }
		$sequence_12 = { b862000000 668945f6 33c9 66894df8 8d55b0 52 }

	condition:
		7 of them and filesize < 322560
}